use proper authenitcation constant for password; only issue email claim if present